Remember that as established by the General Circular of the Superintendency of Industry and Commerce, data controllers who are obliged to register their databases within the National Data Base Registry (NDBR) must perform the annual update of the said registry at the beginning of each year. Data controllers must perform the update between January 2nd and March 31st every year.

The annual updates to the RNBD must include any changes to the databases within the previous year, i.e., if the number of data subjects included in the database changed, if there was any change in the corporate name of the data controller, among others.

Note that substantial changes, including those related to the purposes of handling data, the data processor, the attention lines, classification and types of personal data, and international data transfers and transmissions, must be reported within the first ten (10) business days of the month in which the changes took place.

If any substantial changes still need to be registered by the time of the annual update, those should be registered at the annual update.

Also, it is necessary that within the first fifteen (15) business days of February, which means that no later than on February 21st, 2025, the data controllers perform the corresponding report of claims presented by data subjects in the previous semester (July to December 2024).

At last, the companies that must comply with the database registry obligation are those with assets of more than 100.000 UVT (for 2025 COP $4.979.900.000, approx. USD$1.137.742). However, all the entities that perform any data handling activity (i.e., collecting, using and storing) must comply with the other obligations established in the data protection regulation.

We look forward to any queries you may have or supporting your team in compliance with the abovementioned obligations.

Author: Felipe Olaya